Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via     deeply nested field names in multipart form data. The append-field dependency parses bracket notation in     field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested     object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is     sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x     prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application     requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker     can send per request. This does not fully mitigate the issue but limits the impact. (CVE-2026-5079)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via
    deeply nested field names in multipart form data. The append-field dependency parses bracket notation in
    field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested
    object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is
    sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x
    prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application
    requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker
    can send per request. This does not fully mitigate the issue but limits the impact. (CVE-2026-5079)

ID	Name	Product	Family	Type	Severity
341761	Linux Distros Unpatched Vulnerability : CVE-2026-5079	Nessus	Misc.	Local	high
443368	SCA: security update for multer (GHSA-72gw-mp4g-v24j)	Tenable Cloud Security	SCA Checks	Local	high
443368	SCA: security update for multer (GHSA-72gw-mp4g-v24j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-5079

high

Tenable Plugins

high

high

high